n8n/packages/cli/test/integration/middlewares/body-parser.test.ts

import type { Request, Response } from 'express';
import { createServer } from 'http';
import request from 'supertest';
import { gzipSync, deflateSync } from 'zlib';

import { rawBodyReader, bodyParser } from '@/middlewares/body-parser';

describe('bodyParser', () => {
	const server = createServer((req, res) => {
		const expressReq = req as unknown as Request;
		const expressRes = res as unknown as Response;
		void rawBodyReader(expressReq, expressRes, async () => {
			void bodyParser(expressReq, expressRes, () => res.end(JSON.stringify(expressReq.body)));
		});
	});

	it('should handle uncompressed data', async () => {
		const response = await request(server).post('/').send({ hello: 'world' }).expect(200);
		expect(response.text).toEqual('{"hello":"world"}');
	});

	it('should handle gzip data', async () => {
		const response = await request(server)
			.post('/')
			.set('content-encoding', 'gzip')
			// @ts-ignore
			.serialize((d) => gzipSync(JSON.stringify(d)))
			.send({ hello: 'world' })
			.expect(200);
		expect(response.text).toEqual('{"hello":"world"}');
	});

	it('should handle deflate data', async () => {
		const response = await request(server)
			.post('/')
			.set('content-encoding', 'deflate')
			// @ts-ignore
			.serialize((d) => deflateSync(JSON.stringify(d)))
			.send({ hello: 'world' })
			.expect(200);
		expect(response.text).toEqual('{"hello":"world"}');
	});

	it('should sanitize XML tag names', async () => {
		const response = await request(server)
			.post('/')
			.set('content-type', 'application/xml')
			.send('<test><__proto__/></test>')
			.expect(200);
		const body = JSON.parse(response.text);
		expect(body.test).toHaveProperty('sanitized___proto__');
		expect(({} as Record<string, unknown>).polluted).toBeUndefined();
	});
});